“HAIDEMENOS MODEL INDUSTRY OF GRAPHIC ARTS S.A.”
Document Details
- Edition
- 01
- Status
- Final
- Date
- 16.12.2022
- Document Classification
- Internal distribution
Πίνακας Αναθεωρήσεων
- Edition
- 01
- Date
- 16.12.2022
- Description
- Sustainable Development Policy
1. PART ONE – PREAMBLE
The protection of personal data of employees, customers and other natural persons associated with the company "HAIDEMENOS SA" (hereinafter: the Company) is a fundamental right of natural persons and is a basic concern of the Company.
The Company adopts all principles and rules for the protection of natural persons and takes all necessary measures for their protection.
The Rules, included in this Policy, are binding on the management and employees of the Company.
In this Policy, the following definitions shall apply
- (a) "Company": The company "HAIDEMENOS SA"
- (b) "Subjects": employees, customers, suppliers, shareholders and other natural persons connected with the Company
- (c) “Data”: personal data
- (d) "Processing": any operation performed on personal data, such as collection, recording, storage, alteration, use, dissemination, erasure, destruction, etc.
- (e) “Processor: the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller
2. PART TWO – PRINCIPLES
2.1 Personal data are processed lawfully and fairly in a transparent manner, i.e:
- (a) the data are easily accessible to the data subjects
- (b) the data are limited to what is necessary for the purposes of the processing
- (c) the Company shall inform the data subjects of its identity and the identity of any processor;
- (d) the Company informs the subjects of the purposes of the processing, their rights in relation to the processing, the period of storage of the data and the recipients of the data
2.2 Data is collected for specified, explicit and legitimate purposes, i.e. separately provided that:
- (a) the subject has expressly consented to the processing of his/her data for a purpose that has been communicated to him/her by the Company. The consent is given in writing or by other appropriate means.
- (b) the processing is necessary for the performance of a contract to which the subject is a party, such as, but not limited to, the payroll of employees, the performance of contracts with customers, suppliers, associates, etc.
- (c) the processing is necessary for the compliance of the Company with its legal obligation in the field of labour law and social security and social protection law, such as, but not limited to, tax, insurance obligations, etc.
- (e) the processing is necessary to safeguard a vital interest of the data subject or another natural person, such as, but not limited to, private insurance of employees;
- (f) the processing is necessary for the achievement of the purposes of the Company, provided that fundamental rights or freedoms of the data subject are not overridden
2.3 Special categories of data shall be processed where provided for by the applicable legislation and in particular for the fulfilment of obligations under labour law, social security and social protection legislation or for the purposes of preventive or occupational medical assessment of a worker's fitness for work by or under the responsibility of a professional subject to professional secrecy.
2.4 The Company may forward personal data to judicial, administrative, tax, customs, or other public authorities and lawyers if this is necessary to comply with the law or to establish, exercise or defend legal claims. It may also assign part or all of the processing to third parties (processors), which have contracted with the Company to provide postal services, transport services, computer services, security services, insurance services, banking and credit institutions, accounting firms. The Company complies with the law and takes appropriate measures to protect the personal data forwarded, including measures such as the contractual commitment of third parties.
3. PART THREE – SUBJECT’S RIGHTS
3.1 Right to information and transparency: The Company provides data subjects with clear information about the data it processes and the purpose of the processing.
3.2 Right of Access: The data subject has the right of access to his/her data and in particular to receive from the Company a copy of his/her data and information on the purposes of processing, the categories of his/her data, the recipients, the storage period, the right to rectification and/or erasure, the right to lodge a complaint with a supervisory authority, the existence of automated decision-making, if any.
3.3 Right to object: the data subject has the right to object to the processing of his/her data unless the processing is necessary for reasons which override the interests or rights of the data subject or for the establishment, exercise or maintenance of legal claims.
3.4. Right to rectification - restriction of processing - deletion: The data subject has the right to request the correction of inaccurate data, the restriction of processing or the deletion of his/her data, if he/she withdraws his/her consent, or if they are not necessary for the purposes for which they were collected, or if they were processed unlawfully or if a legal obligation must be complied with. The Company may refuse deletion if there are legitimate reasons, in particular to comply with a legal obligation and to establish, exercise or support its legal claims. The Company shall communicate the rectification, restriction or deletion to each recipient to whom the data were disclosed, unless this is impracticable or involves a disproportionate effort.
3.5. Right of complaint: The data subject has the right to lodge a complaint with the competent supervisory authority if he/she considers that his/her legitimate rights are violated with regard to the processing of his/her data.
3.6. Manner of exercising the above rights: In order to exercise the above rights, the subject may communicate with the Company by using electronic mail at the address announced on the Company's website.
4. PART FOUR – ORGANIZATIONAL AND TECHNICAL MEASURES
4.1. The Company takes the appropriate technical measures for the security of data in the IT systems it uses. In order to prevent unauthorized access or disclosure, the Company has taken appropriate technical and organizational measures to protect personal data from accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access and any unlawful form of processing. This is achieved, among other measures, through the encryption of all the Company's hard disks and through specialized antivirus -antispyware and firewall programs, through the use of passwords for computer users, certified software, etc.
4.2. The Company has a special IT department, which is part of the General Management, and which is responsible for the supervision, operation, maintenance and modernization of the Company's information systems and the secure maintenance of data.
4.3. Access to the data is only allowed to a limited number of persons who are responsible for processing the data for the purposes for which they have been collected. Thus, depending on the purpose of the processing (performance of contracts, obligations under labour or insurance law, etc.), the data are processed only by the person responsible for the purpose of the processing. Similarly, data held in a physical filing system are accessible only to the persons responsible for the purpose of the processing.
4.4. The Company's executives and employees are periodically trained on the basic principles and the basic legislation governing personal data, and are obliged to carry out lawful processing of the data that come to their knowledge.
4.5 In the event of a data breach, the Company shall immediately inform the data subject by all appropriate means and shall notify the breach to the competent Supervisory Authority, requesting its opinion, when the type of processing may result in a high risk to the rights of the data subject and after an assessment of the impact of the breach. However, the Company considers that rarely and only exceptionally will a case of high risk arise, as the data processed by the Company does not generally belong to special categories and are the basic and minimally necessary mainly for the performance of contracts, employment and tax obligations.
5. AMENDMENT
The present Policy is subject to amendment and updating.